Privacy Policy

1. Introduction

Spex Marketing Agency Limited (“Company”, “we”, “us”) is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, store, and share information in connection with the SPEX platform and website (spex.agency).

This policy applies to all individuals who visit our website, create accounts, or use our services.

2. Data Controller

Spex Marketing Agency Limited
Makariou III, 1-7, MITSIS 3, Floor 3
1065, Nicosia, Cyprus
Registration No.: HE 455205
Email: info@spex.agency

3. What Data We Collect

3.1 Account and Contact Data

• Name, email address, company name, phone number
• Billing details (processed via certified payment providers; full card numbers are never stored by us)
• Communication records (emails, support tickets, contract documents)

3.2 Platform Usage Data

• Domain records, server configurations, DNS settings managed through the Platform
• Access logs, session tokens, IP addresses, user agent strings
• Feature usage patterns and interaction events

3.3 Technical and Website Data

• Cookies and similar technologies (see Section 8)
• Browser type, operating system, referring URLs
• Pages visited, time on site, click paths

4. Purposes and Legal Bases

We process your data on the following legal bases:

• Contract performance — to provide Platform access, process payments, and fulfil our obligations under the Software License Agreement.
• Legitimate interests — to improve the Platform, detect fraud, ensure security, and communicate product updates.
• Legal obligation — to comply with applicable EU and Cyprus law, including GDPR.
• Consent — for marketing communications and optional analytics cookies (where applicable).

5. How We Use Your Data

• Providing, maintaining, and improving Platform features
• Processing payments and issuing invoices
• Sending transactional notifications (renewals, alerts, system events)
• Responding to support requests
• Detecting security threats, abuse, and policy violations
• Complying with legal and regulatory requirements
• Sending marketing emails where you have consented or where permitted by law

6. Data Sharing

We do not sell or rent your personal data. We may share data with:

• Service providers acting on our behalf (hosting, payment processing, email delivery, analytics) — bound by data processing agreements.
• Registrar APIs and third-party integrations — only data strictly necessary for the integration to function.
• Legal authorities — where required by law, court order, or to protect our legal rights.
• Business transfers — in the event of a merger or acquisition, subject to continued data protection obligations.

7. Data Retention

We retain personal data only as long as necessary for the purposes described in this Policy or as required by law. Account data is retained for the duration of the subscription plus 3 years. Logs and usage data are retained for up to 12 months. Backup copies may persist for up to 90 days after deletion.

Upon account termination, you may request export of your data within 30 days. After this window, data will be irreversibly deleted.

8. Cookies

We use cookies and similar technologies to:

• Essential cookies — required for Platform functionality (session management, security). Cannot be disabled.
• Analytical cookies — help us understand how users interact with the Platform. Enabled only with your consent.
• Preference cookies — remember your settings and choices.

You can manage cookie preferences via the cookie consent banner on our website. Withdrawing consent does not affect the lawfulness of prior processing.

9. International Transfers

Your data is stored on EU-based servers. Where any transfer outside the EU/EEA is necessary, we ensure adequate safeguards are in place (e.g., Standard Contractual Clauses approved by the European Commission).

10. Your Rights (GDPR)

Under GDPR, you have the following rights with respect to your personal data:

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure — request deletion subject to legal retention obligations
• Right to restriction — limit how we process your data in certain circumstances
• Right to data portability — receive your data in a machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw consent at any time without affecting prior processing

To exercise these rights, contact us at info@spex.agency. We will respond within 30 days. You also have the right to lodge a complaint with the Cyprus Commissioner for Personal Data Protection.

11. Security

We implement appropriate technical and organisational measures to protect your data, including TLS encryption for data in transit, encrypted storage, access controls, and regular security audits. Despite these measures, no transmission over the internet is completely secure. You are responsible for maintaining the security of your account credentials.

12. Children

Our Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice on the Platform. The date of the latest revision appears at the top of this document. Continued use of the Platform after notification constitutes acceptance of the updated policy.

14. Contact and Complaints

For privacy-related questions or to exercise your rights:
Email: info@spex.agency
Postal: Spex Marketing Agency Limited, Makariou III, 1-7, MITSIS 3, Floor 3, 1065, Nicosia, Cyprus

You may also contact the Cyprus Commissioner for Personal Data Protection at dataprotection.gov.cy if you believe your rights have been violated.